Enhanced privacy protection in identification in a data communications network

• US 7,275,260 B2
• Filed: 10/29/2001
• Issued: 09/25/2007
• Est. Priority Date: 10/29/2001
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: de Jong, Eduard K., Levy, Moshe, Leung, Albert Y.
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US10/040,270
• Publication Number:
  US 20030140230A1
• Time in Patent Office: 2,157 Days
• Field of Search: 726 4- 7
• US Class Current: 726/10
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A method for enhanced privacy protection in identification in a data communications network includes enrolling for a service on the data communications network, receiving a randomized identifier (ID) in response to the enrolling, storing the randomized ID and using the randomized ID to obtain services on the data communications network. An apparatus for obtaining a service on a data communications network includes an enrollment authority configured to accept an enrollment request. The enrollment authority is further configured to return enrollment results in response to the enrollment request. The enrollment results include user data and the enrollment results may be used obtaining a service from a service provider.

Claims

1. A method for enhanced privacy protection in identification in a data communications network, the method comprising:

enrolling, by a user, with an authority over said data communications network for a service on said data communications network;

receiving, by said user from said authority over said data communications network, a randomized identifier (ID) in response to said enrolling;

storing said randomized ID; and

using said randomized ID, by said user, and a service request to obtain services, on said data communications network, from a service provider wherein said service provider is different from said authority.

2. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for enhanced privacy protection in identification in a data communications network, the method comprising:

enrolling, by a user, with an authority over said data communications network for a service on said data communications network;

receiving, by said user from said authority over said data communications network, a randomized identifier (ID) in response to said enrolling;

storing said randomized ID; and

using said randomized ID, by said user, and a service request to obtain services, on said data communications network, from a service provider wherein said service provider is different from said authority.

3. An apparatus for enhanced privacy protection in identification in a data communications network, the apparatus comprising:

means for enrolling, by a user, with an authority over said data communications network for a service on said data communications network;

means for receiving, by said user from said authority over said data communications network, a randomized identifier (ID) in response to said enrolling;

means for storing said randomized ID; and

means for using said randomized ID, by said user, and a service request to obtain services, on said data communications network, from a service provider wherein said service provider is different from said authority.

4. An apparatus for enhanced privacy protection in identification in a data communications network, the apparatus comprising:

a smart card configured to store a randomized ID obtained in response to enrolling for a service with an authority, by a user, on said data communications network, said smart card further configured to release said randomized ID to obtain services on said data communications network from a service provider wherein said service provider is different from said authority.

5. A memory for storing data for access by an application program being executed on a data processing system, comprising:

a data structure stored in said memory, said data structure including;

credential data;

an authority peer group ID that identifies an entity that provided data authentication for said credential, said entity comprising a one or more network servers in a data communications network, one of said one or more network servers providing data authentication for said credential; and

a cryptogram provided by said entity and used to authenticate said credential data.

6. A method for obtaining a service on a data communications network, the method comprising:

presenting, over said data communications network an authority on said data communications network with user data and a credential request; and

receiving, over said data communication network, a credential from said authority, in response to said credential request, said credential comprising;

a randomized identifier;

credential user data; and

an indication of the credential user data verification performed by said authority in response to said credential request.

7. A method for obtaining a service on a data communications network, the method comprising:

presenting, over said data communications network, an authority on said data communications network with a logon request;

receiving, over said data communications network, a kerberos ticket in response to said user authentication data, said kerberos ticket comprising a randomized user ID; and

using said kerberos ticket to obtain services from one or more service providers on said data communications network wherein said one or more service providers are different from said authority.

8. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for obtaining a service on a data communications network, the method comprising:

presenting, over said data communications network, an authority on said data communications network with a logon request;

receiving, over said data communications network, a kerberos ticket in response to said user authentication data, said kerberos ticket comprising a randomized user ID; and

using said kerberos ticket to obtain services from one or more service providers on said data communications network wherein said one or more service providers are different from said authority.

9. An apparatus for obtaining a service on a data communications network, the apparatus comprising:

means for presenting, over said data communications network, an authority on said data communications network with a logon request;

means for receiving, over said data communications network, a kerberos ticket in response to said user authentication data, said kerberos ticket comprising a randomized user ID; and

means for using said kerberos ticket to obtain services from one or more service providers on said data communications network wherein said one or more service providers are different from said authority.

10. An apparatus for obtaining a service on a data communications network, the apparatus comprising:

a service provider configured to accept, over said data communications network, a service request and enrollment results obtained from an enrollment authority, said service provider capable of communicating with said enrollment authority to verify said enrollment results, said service provider configured to provide said service based upon said enrollment results and a response from said enrollment authority.